Our Senior Capability Researcher @mhskai2017 found three unauthenticated RCEs across the SolarWinds product line, none requiring user interaction. In Access Rights Manager (ARM), CVE-2026-28326, a hard-coded installer secret defeated the mTLS gate, and a single connection could execute code as the ARM service principal, which is Domain-Admin-equivalent. All versions were affected. In Web Performance Monitor (WPM), CVE-2026-28324, the default passive Player never ran its auth check. Past that, the integrity check compared attacker input against a hash of attacker input, and the signature check accepted any binary whose signer subject contained "SolarWinds." The update endpoint became a SYSTEM launcher. And in the Orion core, CVE-2026-28325, a single crafted WebSocket frame with an empty clientId bypassed the certificate check and reached a binder-free http://Json.NET deserializer as SYSTEM, on a default install with no add-on modules. We reported all three to SolarWinds, and each has since been patched (2026.2.3 for WPM and the Orion core). We waited two weeks after the last fix before publishing so customers had time to update. Kai walks through each one in a new three-part series. Start with Part 1 here: https://www.armadin.com/blog-posts/unauthenticated-rce-in-solarwinds-access-rights-manager-responsible-disclosure-part-1 Part 2: https://www.armadin.com/blog-posts/unauthenticated-rce-in-solarwinds-web-performance-monitor-responsible-disclosure-part-2 Part 3: https://www.armadin.com/blog-posts/unauthenticated-rce-in-solarwinds-core-responsible-disclosure-part-3
Post summary
The post discloses three unauthenticated RCEs in SolarWinds products (CVE-2026-28326, CVE-2026-28324, CVE-2026-28325), providing detailed technical descriptions and linking to a three-part blog series serving as linked PoC walkthroughs. Although patches are confirmed, the core message centers on the existence and sharing of these proof-of-concept vulnerabilities.
